Automatic Software Verification Instructor: Mooly

slide1. Automatic Software Verification Instructor: Mooly Sagiv
TA: Oded Padon Slides from Eran Yahav and the Noun Project, Wikipedia<br>
slide2. Course Requirements Summarize one lecture
10% one lecture notes
45% homework assignment
45% exam/project<br>
slide3. Inspired by Other Courses CS395T: Automated Logical Reasoning (UT Austin) Isil Dillig
SAT/SMT Solver and Applications Graduate Seminar W2013 University of Waterloo (Vijay Ganesh)<br>
slide4. Software is Everywhere<br>
slide5. Software is Everywhere Exploitable<br>
slide6. Exploitable Software is Everywhere The Sony PlayStation Network breach: An identity-theft bonanza
Massive Sony PlayStation data breach puts about 77 million people at higher risk of fraud
(April 2011) RSA hacked, information leaksRSA's corporate network suffered what RSA describes as a successful advanced persistent threat attack, and "certain information" was stolen that can somehow affect the security of SecurID authentication
(March 2011) Stuxnet Worm Still Out of Control at Iran's Nuclear Sites, Experts Say
The Stuxnet worm, named after initials found in its code, is the most sophisticated cyberweapon ever created.
(December 2010) Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat
This vulnerability could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment.
(March 2011) RSA tokens may be behind major network security problems at Lockheed Martin
Lockheed Martin remote access network, protected by SecurID tokens, has been shut down
(May 2011)<br>
slide7. da return address Buffer Overrun void foo (char *x) {
char buf[2];
strcpy(buf, x);
}
int main (int argc, char *argv[]) {
foo(argv[1]);
} memory Saved FP char* x buf[2] … ab ra ca > ./a.out abracadabra
Segmentation fault terminal source code foo strcpy main<br>
slide8. Buffer Overrun Exploits int check_authentication(char *password) {
int auth_flag = 0;
char password_buffer[16];

strcpy(password_buffer, password);
if(strcmp(password_buffer, "brillig") == 0) auth_flag = 1;
if(strcmp(password_buffer, "outgrabe") == 0) auth_flag = 1;
return auth_flag;
}
int main(int argc, char *argv[]) {
if(check_authentication(argv[1])) {
printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
printf(" Access Granted.\n");
printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n"); }
else
printf("\nAccess Denied.\n");
} (source: “hacking – the art of exploitation, 2nd Ed”)<br>
slide9. Attack Application evil input AAAAAAAAAAAA -=-=-=-=-=-=-=-=-=-=-=-=-=-
Access Granted. 65
-=-=-=-=-=-=-=-=-=-=-=-=-=-<br>
slide10. Automatic Program Verification Desired
Properties  Solver
Is there a behaviorof P that violates ? Counterexample Proof ProgramP<br>
slide11. Example int check_authentication(char *password) {
int auth_flag = 0;
char password_buffer[16];

strcpy(password_buffer, password);
if(strcmp(password_buffer, "brillig") == 0) auth_flag = 1;
if(strcmp(password_buffer, "outgrabe") == 0) auth_flag = 1;
return auth_flag;
}
int main(int argc, char *argv[]) {
if(check_authentication(argv[1])) {
printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
printf(" Access Granted.\n");
printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n"); }
else
printf("\nAccess Denied.\n");
}<br>
slide12. Undecidability The Halting Problem
Does the program P terminate on input I
Rice’s Theorem
Any non-trivial property of partial functions, there is no general and effective method to decide if program computes a partial function with that property<br>
slide13. Handling Undecidability Permits occasional divergence
Limited programs (not Turing Complete)
Unsound Verification
Explore limited program executions
Incomplete Verification
Explore superset of program executions
Programmer Assistance
Inductive loop invariants<br>
slide14. Limited Programs Finite state programs
Finite state model checking
Explicit state SPIN, CHESS
Symbolic model checking SMV
Loop free programs
Configuration files<br>
slide15. Unsound Verification Dynamic checking
Valgrind, Parasoft Insure, Purify, Eraser
Bounded Model Checking
Concolic Executions<br>
slide16. The SAT Problem Given a propositional formula (Boolean function)
 = (a  b) ( a b  c)
Determine if  is valid
Determine if  is satisfiable
Find a satisfying assignment or report that such does not exit
For n variables, there are 2n possible truth assignments to be checked
Effective heuristics exit<br>
slide17. Bounded Model Checking Desired
Properties  FrontEnd Assignment UNSAT Program P Input
Bound k SAT Solver Propositional Formula
P(k)  <br>
slide18. A Simple Example<br>
slide19. A Simple Example UNSAT
Assertion always holds!<br>
slide20. Summary Bounded Model Checking Excellent tools exist (CBMC, Alloy)
Many bugs occur on small inputs
Useful for designs too
Scalability is an issue
Challenging features
Bounded arithmetic
Pointers and Heap
Procedures
Concurrency<br>
slide21. Concolic Testing Combine runtime testing and symbolic execution
Runtime testing
Effectiveness depends on input test
Symbolic Execution read(x); y = 2 * x ; assert y != 12;
Need constraint solver
Can be complex
Concolic testing aims to improve both<br>
slide22. A Motivating Example void f(int x, int y) {
int z = 2*y;
if (x == 100000) {
if (x < z) {
assert(0); /* error */
}
}
}<br>
slide23. The Concolic Testing Algorithm Classify input variables into symbolic / concrete Instrument to record symbolic vars and path conditions Choose an arbitrary input Execute the program Symbolically re-execute the program Negate the unexplored last path condition Is there an input satisfying constraint T F<br>
slide24. Example Concolic Testing void f(int x, int y) {
int z = 2*y;
if (x == 100000) {
if (x < z) {
assert(0); /* error */
}
}
}<br>
slide25. Summary Concolic Testing Quite effective:
SAGE (Microsoft Research)
Datarace detection (Candea, EPFL)
Instrumentation can be tricky
Scalability is an issue
Coverage is an issue
Limitations of theorem provers
Data structures<br>
slide26. Invariant An assertion I is an invariant at program location if I holds whenever the execution reaches this location
An invariant is inductive at a loop “while B do C” if whenever C is executed on a state which satisfies B and I it can only produce states satisfying I<br>
slide27. Temporary Cycle Creation rotate(List first, List last) {
if ( first != NULL) {
last  next = first;
first = first  next;
last = last  next;
last  next = NULL;
}
}<br>
slide28. Inductive Invariants x = 2;
while true do {x >0}
x = 2* x - 1<br>
slide29. Deductive Verification Candidate Invariant inv VC gen Inv is inductive w.r.t. P
Inv F SAT Solver Counterexample Proof Program P Goal F<br>
slide30. Summary Deductive Verification Existing Tools
ESCJava, Dafny, CAVEAT
Hard to write inductive invariants
Need to consider all corner cases
Small program change can lead to huge change in the invariant
The lack of specification languages
Deduction can be hard<br>
slide31. Deduction x = 2;
while true do {x >1}
x = (2*x*x + x – 1) / (x + 1)<br>
slide32. Transition Systems The program semantics can be described as (potentially infinite) graph of reachable states
Values of program variables
Program statements and conditions are relations between states
Proving a safety property usually means showing that certain state cannot be reached
A bad reachable state indicate a bug
Bounded model checking and concolic testing explore subsets of reachable states<br>
slide33. Example Transition System 1: x = 2;
2: while true do
3: x = 2* x – 1
4:<br>
slide34. Abstract Interpretation Automatically prove that the program is correct by also considering infeasible executions
Abstract interpretation of program statements/conditions
Conceptually explore a superset of reachable states
Sound but incomplete reasoning
Automatically infer sound inductive invariants<br>
slide35. Automatic Program Verification Desired
Properties  Solver
Is there a behaviorof P that violates ? Counterexample Proof ProgramP Unknown<br>
slide36. Interval Based Abstract Interpretation 1: x = 2;
2: while true {x > 0} do
3: x = 2* x – 1
4:<br>
slide37. Interval Based Abstract Interpretation 1: x = 2;
2: while true {x > 0} do
3: x = 2* x – 1
4:<br>
slide38. Interval Based Abstract Interpretation 1: x = 2, y = 2
2: while true {x =y} do
3: x = 2* x – 1,
y = 2*y -1
4:<br>
slide39. Shape-Based Abstract Interpretation node search(node h, int v) {
1: node x = h;
2: while (h != NULL) {
3: if (x->d == v) return x;
4: assert x != null; x = x->n ;
}
5: return (node) NULL h 1::<br>
slide40. Shape-Based Abstract Interpretation node search(node h, int v) {
1: node x = h;
2: while (x != NULL) {
3: if (x->d == v) return x;
4: assert x != null; x = x->n ;
}
5: return (node) NULL h 1:: x h 3,4::<br>
slide41. Odd/Even Abstract Interpretation 1: while (x !=1) do {
2: if (x %2) == 0
{ 3: x := x / 2; }
else
{ 4 : x := x * 3 + 1;
5: assert (x %2 ==0); }
6: } /* x=O*/ 1: ?<br>
slide42. Abstract Interpretation Concrete Sets of stores<br>
slide43. Odd/Even Abstract Interpretation  {-2, 1, 5} {0,2} {2} {0}  ? All concrete states {x: x  Even}<br>
slide44. Odd/Even Abstract Interpretation  {-2, 1, 5} {0,2} {2} {0}  ? All concrete states {x: x  Even}<br>
slide45. Odd/Even Abstract Interpretation  {-2, 1, 5} {0,2} {2} {0}  ?  All concrete states {x: x  Even}<br>
slide46. (Best) Abstract Transformer Concrete Representation Concrete Representation Abstract Representation Abstract Representation Abstract Transition St<br>
slide47. Odd/Even Abstract Interpretation 1: while (x !=1) do {
2: if (x %2) == 0
{ 3: x := x / 2; }
else
{ 4 : x := x * 3 + 1;
5: assert (x %2 ==0); }
6: } /* x=O*/ 1: ?<br>
slide48. Summary Abstract Interpretation Conceptual method for building static analyzers
A lot of techniques:
join, meet, widening, narrowing, procedures
Can be combined with theorem provers<br>
slide49. Tentative Schedule<br>